IRONSMITHINTEL
CRITICALCVSS9.8
|CVE-2023-24941|Auth: none|Reboot: required|Manual only

KB5026363: Windows Server 2016 Security Update (May 2023)

A crafted NFSv4.1 call can give an attacker SYSTEM-level code execution on any Windows Server running the NFS role.

Published May 9, 2023 · Updated May 21, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

An attacker on the network who can reach the NFS server's ports (typically TCP/UDP 2049 plus the portmapper and lockd helpers) can send a crafted NFSv4.1 call that triggers the bug and runs code as SYSTEM on the file server. From SYSTEM the attacker has full control of the file shares — read, write, delete, ransomware-encrypt, and from the same foothold, pivot to clients that mount the shares.

How the attack works

The Windows Network File System (NFS) Server role lets Windows servers share files with Linux, Unix, and ESXi clients using the NFS protocol. When the server is processing incoming NFSv4.1 calls containing utf8strings and is low on memory, an input-validation flaw lets crafted call data corrupt memory and execute code in the NFS service context.

Am I affected?Quick check

Probably yes if any of these apply:

●Windows Servers running the Server for NFS role
●Mixed Windows/Linux/ESXi storage environments

Affected OS versions

Windows Server 2016
Real-world incidentsWhat we've seen

A mixed Windows/Linux datacentre exports a fileshare via NFS to a fleet of ESXi hosts that store VM disks on it. An attacker on the storage VLAN sends a crafted NFSv4.1 call to the Windows NFS server, lands SYSTEM, and is now positioned to modify or encrypt every virtual disk file the cluster uses. NFS attack surface is often forgotten by Windows administrators because it is "Linux territory" — which is precisely why it remains under-patched.

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB5026363

Manual remediation steps

Temporary mitigation

If the patch cannot be applied immediately, Microsoft recommends temporarily downgrading the server to NFSv2 or NFSv3 — the bug is in the NFSv4.1 utf8string parser specifically.

# Check current NFS Server version configuration
Get-NfsServerConfiguration | Select-Object EnableNFSV2, EnableNFSV3, EnableNFSV4
# Disable NFSv4 (forces clients to v3)
Set-NfsServerConfiguration -EnableNFSV4 $false

This is a temporary measure — apply the cumulative update as the durable fix.

Prerequisites

    1
    Local administrator on the target server
    1
    Maintenance window with reboot capacity
    1
    Current backup or snapshot you can roll back to
    1
    Network path to Windows Update / WSUS / Microsoft Update Catalog

Estimated time

20–40 minutes per server (download + install + reboot)

Reboot required

Yes — install the cumulative update and reboot the server before the fix is active.

Steps

1. Confirm the server is missing the patch

Get-HotFix -Id KB5026363 -ErrorAction SilentlyContinue

2. Install the update — pick one channel

Windows Update / WSUS (preferred):

UsoClient ScanInstallWait
# (or use your standard WSUS / SCCM / Intune deployment for KB5026363)

Manual download (offline / air-gapped):

1
Open Microsoft Update Catalog: https://catalog.update.microsoft.com/Search.aspx?q=KB5026363
2
Download the MSU for Windows Server 2016 that matches your architecture (x64).
3
Copy the .msu file to the server and run as Administrator.

3. Reboot

Restart-Computer -Force

Verification

Get-HotFix -Id KB5026363
[System.Environment]::OSVersion.Version

Rollback

wusa.exe /uninstall /kb:5026363 /quiet /norestart
# Reboot after uninstall

Removing a cumulative update also removes every fix it delivered — prefer rolling forward.

Notes

    1
    This entry covers Windows Server 2016 specifically (KB5026363). Other Windows Server versions have their own KB for CVE-2023-24941.
    1
    Reference advisories: MSRC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24941 and NVD https://nvd.nist.gov/vuln/detail/CVE-2023-24941.
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2023-24941↗ MSRC Advisory↗ NVD↗ KBKB5026363